Verify a decision

{"actor":"system:backfill","investigation_id":"f1c828ea-6342-4e9c-bcdb-cee7a206eaca","kind":"publish","page_slug":"ai-war-fear-scam-network-oramama-token","published_at":"2026-09-21T17:21:39.137Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"AI War-Fear Scam Network (ORAMAMA Token)","sections":[{"content":"ZachXBT, an independent on-chain investigator, published findings on March 23, 2026, identifying a coordinated network of more than 10 accounts on X (formerly Twitter) engaged in a two-stage manipulation scheme: first, building large follower bases through emotionally charged, fabricated geopolitical content; second, simultaneously executing cryptocurrency pump-and-dump promotions against those accumulated audiences. The operation is distinct from a standard token rug pull in that the infrastructure was purpose-built for audience farming, with the crypto promotion representing only the monetization phase of a longer-running influence operation. ZachXBT characterized the scheme's broader significance with the observation: 'It's scary to think about the implications of it if a nation state actor operated the same scheme rather than a meme coin scammer given how easy it is to operate.' Following ZachXBT's public disclosure, X suspended all 16 scam accounts he identified.","heading":"Network Overview and Threat Classification","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — CoinEdition","type":"news_article","url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"},{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic To Fuel Pump-and-Dump Crypto Scams: ZachXBT — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/"}]},{"content":"ZachXBT identified a total of 16 X accounts ultimately suspended, with at least 10 to 11 forming the active promotion cluster. The accounts were not newly created but were purchased pre-existing profiles with established follower bases, a method that allows operators to bypass platform age restrictions and appear credible to algorithmic amplification systems. The personas adopted a playbook of three archetypal character types, which ZachXBT described as: 'AI PFPs (Asian news guy, rich Sheikh, Chinese oracle).' A prominent lead account operated under the handle @wanglaurentceo (public identity: 'Wang Laurent'), which had accumulated approximately 79,900 followers and reportedly cycled through 17 different usernames over approximately two years, including handles such as 'usdtt11,' 'xrpinsol,' and 'edtrumpofficial.' Two other identified accounts were @BinsaeedRashid (presenting as UAE crypto commentator 'Rashid bin Saeed,' with over 350,000 followers and at least three username changes since January 2025, despite a US geolocation) and @cn_redoracle (presenting as a Chinese breaking news source). A key AI-specific indicator: ZachXBT noted that one account's profile photo appeared to be an AI-generated image created by running Mario Nawfal's profile picture through an image generation tool, producing an artificial Asian version of the well-known crypto media personality. The simultaneous blocking of ZachXBT's account by all 11 active accounts immediately following his public disclosure was cited by him as behavioral evidence of centralized control: 'almost as if they're operated by one person.'","heading":"Account Network Composition and AI-Generated Personas","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT exposes viral Cuba and Iran 'news' accounts as crypto scammers running AI deepfakes — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-crypto-scammers-ai-deepfakes/"},{"credibility":2,"name":"Scammers Are Using the Iran War to Steal From Crypto Users: ZachXBT's Full Expose — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605293458"},{"credibility":2,"name":"ZachXBT Uncovers 10+ X Accounts Driving 6-Figure Crypto Scams With AI Tactics — CastleCrypto","type":"news_article","url":"https://castlecrypto.gg/news/zachxbt-uncovers-10-x-accounts-driving-6-figure-crypto-scams-with-ai-tactics/"},{"credibility":2,"name":"ZachXBT exposes X accounts targeting crypto investors with fake war, geopolitics news — MEXC News","type":"news_article","url":"https://www.mexc.com/news/974818"}]},{"content":"The network's audience-building strategy relied on posting fabricated or heavily distorted breaking news tied to the ongoing U.S.-Iran conflict and other geopolitical flashpoints, multiple times per day. Several specific narrative categories have been documented across secondary reporting of ZachXBT's investigation. First, posts falsely claimed Iran had published a list of specific civilian infrastructure targets to be struck across six countries — Saudi Arabia, the UAE, Qatar, Bahrain, Kuwait, and Jordan — if the United States attacked Iran's power grid. The post named specific facility types including desalination plants, nuclear sites, and power stations. Second, posts falsely claimed Iran threatened to sever undersea cables carrying 95 to 99 percent of global internet traffic. This post reportedly accumulated approximately 26,000 retweets, 50,000 likes, and 1.8 million views on X, even after X's Community Notes system flagged the claim as factually incorrect. Third, account @cn_redoracle and at least one other account in the cluster posted fabricated stories about Cuban hospital blackouts allegedly killing ventilator-dependent patients, with framing attributing the cause to a US blockade. Numerous large, legitimate X accounts that were unaware of the fraudulent nature of the source accounts amplified this content by replying to or quoting the posts, further extending reach. No attribution for these claims to any real intelligence source or news outlet has been established; the claims appear to be wholly fabricated for engagement purposes.","heading":"Disinformation Content: Geopolitical Fake Posts","severity":"high","sources":[{"credibility":2,"name":"ZachXBT exposes viral Cuba and Iran 'news' accounts as crypto scammers running AI deepfakes — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-crypto-scammers-ai-deepfakes/"},{"credibility":2,"name":"Coordinated 'War Fear' Scam Network Exposed on X by ZachXBT — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605298628"},{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X, Says ZachXBT — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"credibility":2,"name":"ZachXBT Exposes Fake War News Crypto Scam on X — CryptocurrencyHelp","type":"news_article","url":"https://cryptocurrencyhelp.com/news/zachxbt-exposes-fake-war-news-crypto-scam-x/"}]},{"content":"On February 22, 2026, at least 10 accounts within the network simultaneously posted promotion for a Solana-based meme coin called $ORAMAMA, traded on the PumpSwap decentralized exchange. The pool address associated with the ORAMAMA/SOL trading pair has been identified as 3f1TfjDWxmj44HaroWHDQKHEkddyxYvAHbXdJJPTqQNh on Solana. Each participating account posted about the token once; none of the accounts mentioned the token again after the coordinated push, consistent with a standard pump-and-dump exit pattern. ZachXBT cited on-chain evidence as confirming the scheme generated six-figure profits in U.S. dollar terms, though the specific wallet addresses used to deploy the token, accumulate pre-launch positions, and extract proceeds have not been published in secondary reporting as of the date of this investigation. The token's CoinGecko listing has been identified. The $ORAMAMA token itself is covered separately in a distinct AVOID.NET investigation; this page concerns the network-level infrastructure rather than the token in isolation.","heading":"$ORAMAMA Token Pump-and-Dump: Mechanics and On-Chain Evidence","severity":"critical","sources":[{"credibility":2,"name":"Onchain Evidence Reveals $ORAMAMA Pump and Dump Scam, Profiting Six Figures — Blockchain.news","type":"on_chain","url":"https://blockchain.news/flashnews/onchain-evidence-reveals-oramama-pump-and-dump-scam-profiting-six-figures"},{"credibility":2,"name":"ORA MAMA Price: ORAMAMA Live Price Chart, Market Cap & News Today — CoinGecko","type":"other","url":"https://www.coingecko.com/en/coins/ora-mama"},{"credibility":2,"name":"ORAMAMA/SOL Pool on PumpSwap — DEX Screener","type":"on_chain","url":"https://dexscreener.com/solana/3f1tfjdwxmj44harowhdqkhekddyxyvahbxdjjptqqnh"},{"credibility":2,"name":"ZachXBT Exposes Social Media Manipulation Network — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605293018"}]},{"content":"Multiple sources summarizing ZachXBT's investigation document a consistent five-step operational playbook. Step one: operators purchase aged X accounts with pre-existing follower bases to avoid the credibility deficit of newly created accounts and to gain access to algorithmic reach advantages. Step two: accounts 'doompost' multiple times per day with emotionally charged, fabricated or heavily distorted geopolitical breaking news, using AI-generated profile images to simulate journalistic personas. Step three: accounts engage in coordinated cross-amplification — reposting each other's content, quote-tweeting, and replying — to artificially inflate engagement signals and surface posts to unaffiliated users. This stage exploited legitimate accounts unknowingly quoting or replying to the disinformation, further extending organic reach. Step four: at a chosen moment of peak audience exposure, the accounts pivot to simultaneous cryptocurrency promotion, fake giveaways, or liquidity extraction plays. Step five: accounts change usernames after the promotion to obscure the history of activity, making retrospective forensics harder. ZachXBT's investigation noted one account in the cluster had undergone 16 or more username changes over a two-year period as an example of this evasion technique.","heading":"Operational Playbook: Account Acquisition, Amplification, and Exit","severity":"high","sources":[{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"credibility":2,"name":"ZachXBT Exposes Coordinated X Scam Network Using War Panic to Promote Crypto Fraud — CoinAlertNews","type":"news_article","url":"https://coinalertnews.com/news/2026/03/23/zachxbt-exposes-x-scam-network"},{"credibility":2,"name":"ZachXBT Exposes X Network Using War Panic to Push Crypto Scams — Crypto2Community","type":"news_article","url":"https://crypto2community.com/crypto-news/zachxbt-exposes-x-network-using-war-panic-to-push-crypto-scams/"}]},{"content":"Following ZachXBT's public disclosure on March 23, 2026, X suspended all 16 scam accounts he had identified, according to multiple secondary sources summarizing ZachXBT's own reporting. No independent confirmation from X (the platform) in the form of a public statement or transparency report has been identified. The suspension status of accounts beyond the 16 specifically identified — or any successor accounts operated by the same actors — is not established in available sources at the time of this investigation. ZachXBT's observation that all 11 active accounts simultaneously blocked him upon publication of his findings was interpreted as behavioral evidence of centralized, possibly automated, account management.","heading":"Platform Response and Account Suspensions","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — CoinEdition","type":"news_article","url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"},{"credibility":2,"name":"ZachXBT Warns Nation States Could Copy Crypto Scam Playbook — BeInCrypto","type":"news_article","url":"https://beincrypto.com/zachxbt-nation-state-crypto-scam-playbook/"},{"credibility":2,"name":"Crypto News: ZachXBT Exposes War Panic-Fueled Scam Network on X — The Coin Republic","type":"news_article","url":"https://www.thecoinrepublic.com/2026/03/23/crypto-news-zachxbt-exposes-war-panic-fueled-scam-network-on-x/"}]},{"content":"ZachXBT's investigation explicitly raised a broader concern beyond the immediate financial fraud: that the same infrastructure — purchased accounts, AI-generated personas, coordinated amplification, geopolitical disinformation — could be deployed by a state actor with far greater resources and for purposes other than meme coin promotion. His quoted assessment: 'It's scary to think about the implications of it if a nation state actor operated the same scheme rather than a meme coin scammer given how easy it is to operate.' BeInCrypto's coverage of the story was framed specifically around this nation-state replication angle. The operation demonstrated that AI-assisted social influence campaigns can achieve viral reach at scale on major platforms with minimal cost, and that Community Notes-style fact-checking mechanisms operate too slowly to prevent initial viral propagation. No evidence has been published indicating the network was operated by or in coordination with any state actor; the known operation appears to have been financially motivated.","heading":"Nation-State Replication Risk and Broader Implications","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT Warns Nation States Could Copy Crypto Scam Playbook — BeInCrypto","type":"news_article","url":"https://beincrypto.com/zachxbt-nation-state-crypto-scam-playbook/"},{"credibility":2,"name":"ZachXBT Uncovers Coordinated Network Exploiting Political Fear to Fuel Cryptocurrency Scams — CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/zachxbt-uncovers-coordinated-network-exploiting-political-fear-to-fuel-cryptocurrency-scams/"}]},{"content":"No identified individual or organization has been named by ZachXBT or any other investigator as the operator of this network as of the date of this investigation. Secondary reporting consistently describes the actor as unknown. The behavioral and technical indicators documented — centralized username rotation, simultaneous account actions, AI-generated profile images, cross-platform coordination — are consistent with a single operator or small group, but no on-chain wallet attribution connecting the $ORAMAMA profits to a named individual has been published in available sources. No law enforcement actions, regulatory filings, or court proceedings related to this specific network have been identified.","heading":"Attribution and Known Actors","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Fueling Fake War Panic — OurCryptoTalk","type":"news_article","url":"https://ourcryptotalk.com/news/zachxbt-crypto-scam-network-exposed"},{"credibility":2,"name":"ZachXBT: X Networks Use Fake War News for Crypto Scams — CryptoNewsZ","type":"news_article","url":"https://www.cryptonewsz.com/zachxbt-networks-fake-war-news-crypto-scams/"}]},{"content":"The primary source for this investigation is ZachXBT's public disclosure thread published on X on or around March 23, 2026. ZachXBT's original thread has not been directly fetched for this investigation due to access limitations; all details are drawn from secondary news reporting. ZachXBT is a well-regarded independent on-chain investigator with a strong track record of accurate disclosures, but his findings have not been independently verified by a regulatory body, law enforcement agency, or Tier 1 news outlet as of this writing. Specific wallet addresses, exact profit figures in dollar amounts, and the full list of involved account handles are not confirmed in the secondary sources consulted. Claims about the AI-operated nature of the accounts are based on behavioral indicators (simultaneous blocking, coordinated username changes, AI-generated profile images) rather than a technical forensic audit. The confidence score reflects the high volume of consistent secondary Tier 2 reporting, tempered by the absence of Tier 1 (regulatory/court) verification.","heading":"Source Limitations and Confidence Caveat","severity":"low","sources":[{"credibility":2,"name":"ZachXBT Exposes Social Media Network Using Fake News to Promote Crypto Scams — KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/zachxbt-exposes-social-media-network-using-fake-news-to-promote-crypto-scams"}]}],"sources_used":[{"credibility":2,"name":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — CoinEdition","type":"news_article","url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"},{"credibility":2,"name":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic To Fuel Pump-and-Dump Crypto Scams: ZachXBT — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/"},{"credibility":2,"name":"Scammers Are Using the Iran War to Steal From Crypto Users: ZachXBT's Full Expose — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605293458"},{"credibility":2,"name":"ZachXBT exposes viral Cuba and Iran 'news' accounts as crypto scammers running AI deepfakes — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-crypto-scammers-ai-deepfakes/"},{"credibility":2,"name":"Coordinated 'War Fear' Scam Network Exposed on X by ZachXBT — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605298628"},{"credibility":2,"name":"ZachXBT Exposes Social Media Manipulation Network — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605293018"},{"credibility":2,"name":"ZachXBT Uncovers 10+ X Accounts Driving 6-Figure Crypto Scams With AI Tactics — CastleCrypto","type":"news_article","url":"https://castlecrypto.gg/news/zachxbt-uncovers-10-x-accounts-driving-6-figure-crypto-scams-with-ai-tactics/"},{"credibility":2,"name":"Onchain Evidence Reveals $ORAMAMA Pump and Dump Scam, Profiting Six Figures — Blockchain.news","type":"on_chain","url":"https://blockchain.news/flashnews/onchain-evidence-reveals-oramama-pump-and-dump-scam-profiting-six-figures"},{"credibility":2,"name":"ZachXBT Warns Nation States Could Copy Crypto Scam Playbook — BeInCrypto","type":"news_article","url":"https://beincrypto.com/zachxbt-nation-state-crypto-scam-playbook/"},{"credibility":2,"name":"ZachXBT exposes X accounts targeting crypto investors with fake war, geopolitics news — MEXC News","type":"news_article","url":"https://www.mexc.com/news/974818"},{"credibility":2,"name":"Crypto Fraud Ring Exploited War Fears on X, Says ZachXBT — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/crypto-fraud-ring-exploited-war-fears-on-x/"},{"credibility":2,"name":"ZachXBT Exposes Fake War Alert Account Tied to Crypto Scams — BeInCrypto","type":"news_article","url":"https://beincrypto.com/zachxbt-fake-war-alerts-crypto-pump-dump/"},{"credibility":2,"name":"ZachXBT Exposes Coordinated X Scam Network Using War Panic to Promote Crypto Fraud — CoinAlertNews","type":"news_article","url":"https://coinalertnews.com/news/2026/03/23/zachxbt-exposes-x-scam-network"},{"credibility":2,"name":"ZachXBT Uncovers Coordinated Network Exploiting Political Fear to Fuel Cryptocurrency Scams — CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/zachxbt-uncovers-coordinated-network-exploiting-political-fear-to-fuel-cryptocurrency-scams/"},{"credibility":2,"name":"Crypto News: ZachXBT Exposes War Panic-Fueled Scam Network on X — The Coin Republic","type":"news_article","url":"https://www.thecoinrepublic.com/2026/03/23/crypto-news-zachxbt-exposes-war-panic-fueled-scam-network-on-x/"},{"credibility":2,"name":"ZachXBT Exposes Crypto Scam Network Using Iran War Panic on X — CoinPedia","type":"news_article","url":"https://coinpedia.org/news/scammers-are-using-the-iran-war-to-steal-from-crypto-users-zachxbts-full-expose/"},{"credibility":2,"name":"US-Iran War Related Panic Is Being Used for Crypto Scams: ZachXBT — CoinGape","type":"news_article","url":"https://coingape.com/us-iran-war-related-panic-is-being-used-for-crypto-scams-zachxbt/"},{"credibility":2,"name":"ZachXBT Exposes Social Media Network Using Fake News to Promote Crypto Scams — KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/zachxbt-exposes-social-media-network-using-fake-news-to-promote-crypto-scams"},{"credibility":2,"name":"ORAMAMA/SOL Pool on PumpSwap — DEX Screener","type":"on_chain","url":"https://dexscreener.com/solana/3f1tfjdwxmj44harowhdqkhekddyxyvahbxdjjptqqnh"},{"credibility":2,"name":"ORA MAMA Price Chart — CoinGecko","type":"other","url":"https://www.coingecko.com/en/coins/ora-mama"}],"summary":"A coordinated network of more than 10 purchased X (Twitter) accounts manufactured fabricated geopolitical panic content — including fake Iranian strike lists, Cuban hospital blackouts, and claims about severed undersea internet cables — to build large audiences before pivoting to cryptocurrency pump-and-dump promotions. On February 22, 2026, at least 10 accounts in the network simultaneously promoted the $ORAMAMA meme coin on Solana via PumpSwap, with on-chain evidence indicating six-figure profits. The operation was publicly exposed by on-chain investigator ZachXBT on March 23, 2026; X subsequently suspended all 16 identified accounts.","timeline":[{"date":"2026-02-22","event":"At least 10 accounts in the network simultaneously promoted $ORAMAMA, a Solana meme coin on PumpSwap, in a coordinated single-day push. None of the accounts mentioned the token again. On-chain evidence later cited by ZachXBT indicated six-figure profits from the operation.","source":"Onchain Evidence Reveals $ORAMAMA Pump and Dump Scam, Profiting Six Figures — Blockchain.news","source_url":"https://blockchain.news/flashnews/onchain-evidence-reveals-oramama-pump-and-dump-scam-profiting-six-figures"},{"date":"2026-03-23","event":"ZachXBT publicly published his findings on X, identifying the coordinated network of 10+ accounts, their geopolitical disinformation tactics, the $ORAMAMA pump-and-dump, and raising concerns about nation-state replication of the playbook. Multiple crypto news outlets reported on the investigation the same day.","source":"From War Clickbait to 6-Figure Crypto Rugs: ZachXBT Exposes X Farming Scam — CryptoTimes","source_url":"https://www.cryptotimes.io/2026/03/23/from-war-clickbait-to-6-figure-crypto-rugs-zachxbt-exposes-x-farming-scam/"},{"date":"2026-03-23","event":"Upon ZachXBT's public disclosure, all 11 active accounts in the network simultaneously blocked him — a coordinated response he described as behavioral evidence of centralized or automated control.","source":"Scammers Are Using the Iran War to Steal From Crypto Users: ZachXBT's Full Expose — Bitget News","source_url":"https://www.bitget.com/news/detail/12560605293458"},{"date":"2026-03-23","event":"X (Twitter) suspended all 16 scam accounts identified by ZachXBT, according to ZachXBT's own reporting as cited in secondary sources.","source":"ZachXBT Exposes Crypto Scam Network Using War Fear Narratives — CoinEdition","source_url":"https://coinedition.com/zachxbt-exposes-crypto-scam-network-using-war-fear-narratives/"},{"date":"2026-03-26","event":"The Daily Hodl published a detailed secondary report on the coordinated network, expanding coverage of the operation's mechanics and ZachXBT's nation-state warning.","source":"Coordinated Network of X Accounts Manufacturing Geopolitical Panic To Fuel Pump-and-Dump Crypto Scams: ZachXBT — The Daily Hodl","source_url":"https://dailyhodl.com/2026/03/26/coordinated-network-of-x-accounts-manufacturing-geopolitical-panic-to-fuel-pump-and-dump-crypto-scams-zachxbt/"}]},"v":1}